64b5f1fe5d8593a2cee70d3b3a562b31a506e840ecd729531f7994c626c9bdcc

Analysis

user interaction
yes
max time kernel
65s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
star_jewhunting.exe
Size 493KB
Sample260910-h65p3azdnf
SHA256 64b5f1fe5d8593a2cee70d3b3a562b31a506e840ecd729531f7994c626c9bdcc
MD5 5cf46a151c4c4aab5916b62f2ca72dfe
SHA1 43641d9fdef2df3b945e1ac7b1c60b869402dc3c
SHA512 3d0248e5c7b9126909bc428cce06c783bb920265f38a1a2d5af9fa100e88a6ab42d7c5399fa2d95a4bc36d3e9eb11be03bd910bdc068bb9369cfb8661136c100
SSDEEP 6144:ZIXYXaam0O0d+AoVHsl5R5dm+m02BktZrdwSE5BENzCucxiltMojGmu9zR0:ZIkHoVMl5RjE0ektZr2SzNz0itMz
TLSH
T1B7B47C05F7A100F9E5B7C178C9A64502EB32BC855371ABDF23E49A9A1F23BD09E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
52	3304	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5576	powershell.exe
3304	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	star_jewhunting.exe

Executes dropped EXE 1 IoCs

pid	Process
4652	WinDivert64.sys

Loads dropped DLL 1 IoCs

pid	Process
3896	star_jewhunting.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2148	cmd.exe
5560	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3712	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2A90DEB5E8F7B7B4AE4A1FF77F09CD18715DCD72\Blob = 0300000001000000140000002a90deb5e8f7b7b4ae4a1ff77f09cd18715dcd722000000001000000420300003082033e30820226a00302010202146349e96678318404e2907ba2bcda7b8cc2a54f09300d06092a864886f70d01010b0500303f310b300906035504061302555331133011060355040a0c0a4a657768756e74696e67311b301906035504030c124a657768756e74696e6720526f6f74204341301e170d3236303930353138353831345a170d3336303930323138353831345a303f310b300906035504061302555331133011060355040a0c0a4a657768756e74696e67311b301906035504030c124a657768756e74696e6720526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aede36719364dbf10827251387b52ab3de94a0767a578b3bc94274409842a4744d59f59673f534cf261d946bd558b1bd684fff822dfc661925dafc4b8be213ef09ed93ddfcf64fd0323511a4f6514ffb891055924a84ca8b0ad60fc84434c71786d8dcf113b14029bd56e611526fc4d964cccfa446f4e8c46b442e4202bfcc4a9ab8943bba400cf82a7fff51ac8a5ef2195fb29f7a0633b0479f22dc13e364dc178d54ce9a8c37cb6d2d10a138f85fade7581d5a4617049a1697d4f98fbefe8fa82d2e2f0ef18bb235ee7da2544482eb82465b38dab5991a81928f8067ddd20cc98b92489d79518c1c8a2b9f1ffc7c92012cdf476cca36c7156491331f26fd150203010001a3323030301d0603551d0e041604147e1eb886e34c5a580cb7bf76b8c32c3053f14287300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100392366099954ea4270fc2f116a4acf0be8a750239cbe8e4acb343af404ce90462e0ff0d8b42631c824f3c702b26041730707a861ed0da9b7c27a7b558aaff168add40035b6e9a8613922551d68cc7a23ed0e14e8883996eca37599cb58b1232dc9bb8ae401a9a8109d850aa19cdeecab09a04869e9fe59ae12e04d81f4cbb8b6897fdf7aea06edcf4b53307a4cb6e68787f11db315bbcd157be3b96669d028d345dfad2fdf7769eee6140116eeb18a516e8a2bf71318ce64557c34c98e0e8da1515f34e767921862a24d1d768fadd0833fd7994cc3f3af785f136e1328c275ff39c1723718e8fba99fd23be67ebd7232b8842b8e13703ba06dec8c4d3a62c5d8	star_jewhunting.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\66F1157BC3041D6E08F959B05908F5A9C219A83A\Blob = 03000000010000001400000066f1157bc3041d6e08f959b05908f5a9c219a83a0200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00310045003800310041003600440041002d0037004300410044002d0034003500350035002d0041003100420045002d003800320043004300310045003400430036004100430038007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f0076006900640065007200000020000000010000005e0300003082035a30820242a0030201020210104150f41b470e8f454db68383de34af300d06092a864886f70d01010b0500301e311c301a06035504030c136163636f756e74732e7365727665722e6c616e301e170d3236303931303037313235335a170d3331303931303037323235335a301e311c301a06035504030c136163636f756e74732e7365727665722e6c616e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dd309724fd379f2ceec8c0e861ab79068b077f93bc57ca8d50464796c9029ca488a11f306eebc6c906b3ac33f5473391bb683be4f5c529371c3a9101f2404253a1c0d6c18313e08178e559d8daf60cc2acb013fefa999e51fd8730dd02323eeeef1249b822dcf1ce8c68368d2f544b4cc84a08d4e9f31dd107dffb83d1ac2d4d8e7d5987aa1f9ff7bbb40a673fa900d1a11f51a7da8de9a951976ddce1df367abaed701fbe7beb599538f9a35d40e2959e2c7f01c8de9abafc3f287eb5913e73e696c666966ca00f2fc78d1aa1c090f7f4bd8ed025cc94e0cc7b5d6e5f16788e64c89f1e57199816915875291d7784198ade3720db65aa5ec69fdff01b7c04910203010001a38193308190300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b0601050507030130400603551d110439303782136163636f756e74732e7365727665722e6c616e82152a2e6163636f756e74732e7365727665722e6c616e82096c6f63616c686f7374301d0603551d0e041604143bb73bb8ce91f5c8aecffe45c6ec19ed04a9745a300d06092a864886f70d01010b05000382010100c1d08c9531eb8c7d4217b390de028cee08751674460a1e131a9c68ea7ec42331515087405b451097cf4304472551257e923a94c37848787c29f811e8f7969dfb2d191ec6752427dd3dceef6471dcd6f9445f4a3d50ab569c3006e54d37298ad101e921e5df52fd2b6098a07f672b961e4d1be3c0e554753c38c49102342ff292770cbec03ce678f4b848100f11026c8dc90736b396cd23edf6350465bb2a91ef247f89cca951f830d75a7b4743a23164bbe28491128658c56f5c92df8b54b8516834446c133eb6168c5fb2f89ce05ebf289bbac4d5135334ff30c12d072426d33ab586a356fc126ef7c5a051aa72643c90dd21faa1f35e4fbae932599bb40fa7	star_jewhunting.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
996	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4308	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334985729352182"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2A90DEB5E8F7B7B4AE4A1FF77F09CD18715DCD72	star_jewhunting.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\66F1157BC3041D6E08F959B05908F5A9C219A83A	star_jewhunting.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe
3896	star_jewhunting.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeShutdownPrivilege	3548	chrome.exe
Token: SeCreatePagefilePrivilege	3548	chrome.exe
Token: SeDebugPrivilege	5576	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe
3548	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3712	3896	star_jewhunting.exe	86
PID 3712 wrote to memory of 4308	3712	cmd.exe	87
PID 3548 wrote to memory of 4228	3548	chrome.exe	101
PID 3548 wrote to memory of 4708	3548	chrome.exe	103
PID 3548 wrote to memory of 996	3548	chrome.exe	102
PID 3548 wrote to memory of 4708	3548	chrome.exe	103
PID 3548 wrote to memory of 4692	3548	chrome.exe	105
PID 3548 wrote to memory of 4692	3548	chrome.exe	105
PID 3548 wrote to memory of 4388	3548	chrome.exe	106
PID 3548 wrote to memory of 4388	3548	chrome.exe	106
PID 3548 wrote to memory of 756	3548	chrome.exe	107
PID 3548 wrote to memory of 756	3548	chrome.exe	107
PID 3896 wrote to memory of 2148	3896	star_jewhunting.exe	108
PID 2148 wrote to memory of 3304	2148	cmd.exe	109
PID 3548 wrote to memory of 1612	3548	chrome.exe	110
PID 3548 wrote to memory of 1612	3548	chrome.exe	110
PID 3548 wrote to memory of 4756	3548	chrome.exe	112
PID 3548 wrote to memory of 4316	3548	chrome.exe	113
PID 3548 wrote to memory of 4316	3548	chrome.exe	113
PID 3548 wrote to memory of 1828	3548	chrome.exe	114
PID 3548 wrote to memory of 1828	3548	chrome.exe	114
PID 3548 wrote to memory of 1220	3548	chrome.exe	115
PID 3548 wrote to memory of 1220	3548	chrome.exe	115
PID 3548 wrote to memory of 5024	3548	chrome.exe	117
PID 3548 wrote to memory of 5024	3548	chrome.exe	117
PID 3548 wrote to memory of 1528	3548	chrome.exe	119
PID 3548 wrote to memory of 4388	3548	chrome.exe	118
PID 3548 wrote to memory of 4388	3548	chrome.exe	118
PID 3896 wrote to memory of 5560	3896	star_jewhunting.exe	120
PID 5560 wrote to memory of 5576	5560	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\star_jewhunting.exe
"C:\Users\Admin\AppData\Local\Temp\star_jewhunting.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$c = New-SelfSignedCertificate -DnsName 'accounts.server.lan','*.accounts.server.lan','localhost' -CertStoreLocation 'Cert:\LocalMachine\My' -KeyExportPolicy Exportable -NotAfter (Get-Date).AddYears(5); $p = ConvertTo-SecureString 'jewhunting' -Force -AsPlainText; Export-PfxCertificate -Cert $c -FilePath 'C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\accounts.server.lan.pfx' -Password $p | Out-Null"
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$c = New-SelfSignedCertificate -DnsName 'accounts.server.lan','*.accounts.server.lan','localhost' -CertStoreLocation 'Cert:\LocalMachine\My' -KeyExportPolicy Exportable -NotAfter (Get-Date).AddYears(5); $p = ConvertTo-SecureString 'jewhunting' -Force -AsPlainText; Export-PfxCertificate -Cert $c -FilePath 'C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\accounts.server.lan.pfx' -Password $p | Out-Null"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$c = New-SelfSignedCertificate -DnsName 'update.msiservers.lan','*.update.msiservers.lan','localhost' -CertStoreLocation 'Cert:\LocalMachine\My' -KeyExportPolicy Exportable -NotAfter (Get-Date).AddYears(5); $p = ConvertTo-SecureString 'jewhunting' -Force -AsPlainText; Export-PfxCertificate -Cert $c -FilePath 'C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\update.msiservers.lan.pfx' -Password $p | Out-Null"
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$c = New-SelfSignedCertificate -DnsName 'update.msiservers.lan','*.update.msiservers.lan','localhost' -CertStoreLocation 'Cert:\LocalMachine\My' -KeyExportPolicy Exportable -NotAfter (Get-Date).AddYears(5); $p = ConvertTo-SecureString 'jewhunting' -Force -AsPlainText; Export-PfxCertificate -Cert $c -FilePath 'C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\update.msiservers.lan.pfx' -Password $p | Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5576

C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert64.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff83cf4c728,0x7ff83cf4c734,0x7ff83cf4c740
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,6648940314002801601,14230091438443304452,524288 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,8592123437226303926,16800827119986867128,262144 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,18389440169068263499,12984076210024965040,524288 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,13323325088610753929,498215142322669304,2097152 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,7937143431057829266,17687985254957541650,2097152 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,11939508774910711680,2351086745846585385,2097152 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,17940215011816586949,5883973715719358897,524288 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5580,i,16026128689267529912,17909624070138406866,2097152 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4604,i,11102846489781101803,2335530957127299398,2097152 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3696,i,467714061932177276,4895635851219093828,2097152 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,11888806387913497981,7305791651434551725,524288 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,18037254948594549393,8985451935946612025,524288 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,1861774337949819515,15166439607434453927,524288 --field-trial-handle=2108,i,7584240487891594478,898608134238686397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4e1f723c8341dcb811a680d6bc6643fe7f7e10c88ebdaf37847ac40406bacd34
MD5 1eb994b3d170ae5daaa58c5322383c7e
SHA1 1923988e527552b892695d0e4c691f48941c21d1
SHA512 59f470bdc5d942fc7b05c1743ea6639995d6bd5c710b9e8765ba64206f1b1f49b53e7b4bd712077b34bead8c8ba0810676ea4c039ee723e3f296fcd457698a2c
TLSH
T1C9E02BAAD936AC676DFD4B2C50844B46D64013573B40894F3A3CC10ECFB863B058581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 a549e3affb4339499fd94119e196d251027661bf3b8b77e4fc6d0cd9b88bf401
MD5 84fec377efef26d27838e6b3c1a3b1ff
SHA1 e05847e3ec4f58dfbc65ceb02e81ee326917d955
SHA512 905413393f4497fe9c212b87bed7c3dbb2f45cd4128b7c9176c6ca9946f2b1c0b34c81b92091ce9e5a06c67143894ba684b705d7f4ef2241ae9fb344ca969317
TLSH
T157E02EE5A0DCE2CCFF4C033C35800F01230220740A83130B8190C334AAD32E0C43F85A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7006bd673e10cd69b804f499868d7b0887bd0ce2d5ed378029d6ea0041a5a521
MD5 45f66dafe8b8fe926001ca3891502f38
SHA1 be6221c20475b163e64520dac5dd99e777fb5bed
SHA512 acde588ef39a6e0531ab7c55694bf1b70df2ada1269b97b38a2cb6a8be2d1f9f96489e7ecb9174844090664662cbd0b0d46d532a764297b73cbaeb91ab5e3033
SSDEEP 96:DMBMUaIjqgaUVM3H1uFuguFuRQuruCugQupuPp:DMraIjPaUVM3ViBgYQWB8yo
TLSH
T1CD914DF7C3E4863D891196F4AB152E3ECE790E24535C3C66C9E4AE1B53E68B1E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 36800e72c14702afa5d5d88455ded01b47fdb30786af1a042227db96d9d21538
MD5 f4abd2399cec16db8499f28a55081554
SHA1 e26672644890d41a381d3e5678c71a94c099111b
SHA512 f689e13d41557c7bc99693776ca6e817d84e7c4d6f276d32ac9f9dc7d1fa045807ab5ac18d34e766f40f90dd720e90ba06419a4f2c5f840a68f67eda1e93b6e9
TLSH
T15A117FE7D3FB766750BA18EB0D043C0A2E76AC31115074F6DE5642BC60929F31B15833
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 128397772821953badf5727b1c156e97534fdb8ab602984537a8266cb578025b
MD5 39b9a06751c24f527fad65e94b533d8b
SHA1 9f34d41bdcc5d1d6e81fe019dfdc3c2bc6005973
SHA512 bf277a6c3cda90c8c66b7334eebe527d8d23b568800a1a7c2f5c48683a81b6e06fe4c8124ae4a536ed27ef73efff94b3cedcd8b3d30b10724fabb7b40d9cfe2e
SSDEEP 192:hRbzuKKtxgiDv7qhAPRp2hM4f9DHsb+WN3sIviDo2IiP3PIrPyIsnAUge:hRbzuK+77u8X+5wzl2fofe
TLSH
T13E42C52AA910293B5CDBD72AFD627B17D7F6242275D41E94EAFC892C14E76CC312700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\00903d51-2d06-432c-83db-6b17ce207639\index-dir\the-real-index
Size 120B
SHA256 163d6ba25d4bebed43384da6f1b50b6b6a0075c0213076d5b11d388eb11781e4
MD5 995420a7ed2f28efbd30e1b49f37ae54
SHA1 b783dcdc7543337ea278d046c7435596ecc0b9a3
SHA512 1a5e7011d2df2c2b905f745a0c2415eacbd5ae44a9b3a00f1612e339301b862e47edefa2c61f46684e84a08fb521e6476df12643454aac32adca8b5b9e6e2611
TLSH
T11AB0121C82700280D80A80BD0E411B8058526E21BA44039E80B07179D0B34CB8203454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e3bf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\00903d51-2d06-432c-83db-6b17ce207639\index-dir\the-real-index~RFe59e3bf.TMP
Size 48B
SHA256 d1746611dd8ea13110ece62efb8207de7c01280060d15d35a636584fd591e2f0
MD5 c119fe992abe1966ce36f122cc22353c
SHA1 80626f606255fb20dda837c9d2126bdb8806867e
SHA512 2d2a869c81249f846ef857293a58aa79de55c60fb0a33cebc7cde4be236e981edb9cf3096ed1907640ed1982f1547f20fffbe0780082cc3e351234d19682f1f6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 8106279826def7a262371ddacb0b4e1caf60bb3d02dd599bd97ebb45b908fdf3
MD5 634e6a37b2ef65343c06bbd110ec9069
SHA1 b2624a6e148da231bc8466209aab96672f9bc0b5
SHA512 fb4350d52881272d48a152106fd7025a352ed984267329006938bd6f7850d1d5177a0596692ff292458e98a9e4bfa999e6ead31735abd8be1f958fa6c65c3c17
TLSH
T14BC09BDB0551964A4D70DEC53078B31ED77B464D8CD1DCE89105944730BC9534406D75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 dff592f290546dfe6f50df2f0a83b80cfde05eec1dc90bf262628d44037428a9
MD5 5834f79b45c850dfa8f1edd3c0cb36b7
SHA1 a9e60ee1081432ea8ad6db30c6b613e1a03629cc
SHA512 d9d309ec70a5b6e12dc56b9b62c472a6a884f1464e85756814722f3b811e4d9748c2257c11e92c4f69dd976d0b7af18b519e91598036d2fafb669197c5aca76d
TLSH
T150D022DE46729B4A4E30AAC1B07CA24FA2376D09DC84ECE8A40AB09730FC643C40A875
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 131B
SHA256 c4d2206eca7b985e16d71405a2fc4bb9b4c9f0c78d4d88eb5f9629517d0da457
MD5 baf052592f82ee17945b543bd2831d72
SHA1 b50e3eace09dec365fb59373db9aced361342d96
SHA512 f9a074645bc8363ecf5169311c3612b52312ed3e6694e9c20f3fc0d619e899ab4c50cc903d86950ea814a3c00c4386ff34c4e090a8847fd671ad31e9832ae2f8
TLSH
T128C09BDB085157564E709AC53074B31EDB7B454D8CD1DCEC9106944730BC9534406DA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59dfe6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59dfe6.TMP
Size 137B
SHA256 2edfc27372602e961de3f27e2bedb39e3c723f30aa5262b82bc3f5e066c1d011
MD5 2eb7fe4f1e7d83ae0ecd939ffcc87178
SHA1 1ba96e9078c16d0c2d03484e1233c523097bc04c
SHA512 a0304b43ddccdd5e22f7709e2fc7811c1471fb41611298e4c4e930f598ebdc4963c1dad6da3f9b296753a748a00f87fdff864e41a9e3d644e4df389f20aafd7a
TLSH
T1D0C09BDB045256464F7159C57034B34ED77B4E4D8CC1DCE8D147744730BC9538505D65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2c83c8071ff09ddd33dede4158f5f1815e7423defb262b02328c5af9fc992690
MD5 96ef7e58dbdaab709a1c5da3273c389a
SHA1 f8e83a4e377d09493927cc8ddc529267f52a3f7b
SHA512 408a919cdc11ce86e95da89287d8a65c932aa1e50e883c4d8246e7e92164114539b7099821237a95af5067ce674b2bfd5fe005a4a3e82de622992508a74f7764
TLSH
T12DB01200818B5520CC0040F01608744911005EB684101207D2F4E9C5DD930F05215915
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 f53c23323fddc670f2c6b1da0c99eabe57f52852339069713509f498013bc1b6
MD5 bd2aa257b2391231f26309a618e339b2
SHA1 63c2402cdbe6a6b0b9b6b19eb476f1e08e5c621b
SHA512 95d35968aea22318809b0da1f2324d2261d961ed04679fabaa0cc62d53870eabbe48c80a73c64159e5e266b9f52327b5110fd5f008b1a24acf8affeec4802eae
SSDEEP 6144:0imqf4pvhtmkKAXz43+eC1r71im7Rkm1tYpBeh2BAoZ:0zqsvhYmX8ueiv79oBGcAoZ
TLSH
T13734230FEE7964B359A97B1C708F2B1F4AF11EA88C30DAD0D956A5047BE6BCC1545A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 011c6890db87590f8cb6807428c13ee14d26f90d2951aa81d9121ce911f26f57
MD5 bf9462fc736e34f61f336783d4a95015
SHA1 9880b5a1c5e553c324d7eb796bbd0bede41c76f1
SHA512 833365f8d997149d82fc9ceef078b29e29f0c90929bbfde499109879d8c8472f4a15dba71eb11d82292c8cc733acb3ad3b38394d061e9cd1184207c38b2b56b3
SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:tm7Rkm1tYpBeh2BAoO
TLSH
T135C3123B5D65E9375D78A71EB48E0B1E1EF24DA6C930DE42C8D46A0433FA7CC1945A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 46557bfee134e1662f0f394b29e9768655f1dd8dbf3f271308e0b77cab9f6d35
MD5 349dee6baf204325aab545b28ed687c0
SHA1 62d83ab8ad1de53ed6bb293a3cdc4f0de458dc02
SHA512 2bc794a7a4f2f9545a563f6fd264eca640b209fdcb9371a5845a55f0fcee47690c2cb56e5f7e739956275e7e1fef767403302585abca5d6a902262fefa53550c
TLSH
T1A661EE313375B1E8C8163F071E68198053BF4396EAA4AF0CB698625EDD2741B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 d0a8393572709aa7b9c46ad0b23eeb1fd5b1020f2f3d3ba17665e5e2c22f4322
MD5 6c42c6a19c8b7b50bdaff00009194e07
SHA1 99350be1e5cee40388a7ee7f50ecb1285c64e353
SHA512 fee4208b8e4c62393a57c678e8573cd34f4d7b5025cb4a337ff2f565eecffe8d7ed17e30174f83f0c055f233d2a6fe92371ccaa008b79b96e0a95ca9d5a839fa
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+Eya5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3J
TLSH
T122334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4dbbf4aa850aa5192f230b192705aa9b902005b57f54abae8c42785af03a0623
MD5 9ed512bd17bdb1c8e6c6b656d56a72cb
SHA1 e1ea975abdf715b89d2d9dca007699be69afae88
SHA512 699cc0b013eb77421e65add8aa77ee7d6cea2341364564a7d57d20180a8d45a3383102cfca277599cde0a160e96c41fed36597a9268de3863d036cdd50c9b8ed
TLSH
T109218927B38C9921DC86113A009E9D11767583C781DFDF9F6FC0D21490BF984CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

WinDivert.dll

Path C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accounts.server.lan.pfx

Path C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\accounts.server.lan.pfx
Size 2KB
SHA256 b49a80fd85c0787ace11c3cea0d389c5e00403407f5a623134f5da6393c0ab61
MD5 c98d9e4b3605e8e7ea8161b0120db9d6
SHA1 75855772915b2cb35f3675c1a9b2bc1cd5305e36
SHA512 bb34238ef1056bfe5437465df8ac51a3854052a173731f0237ce6d0413538cbb1136ebb9e2af68f1508ebb778cd4cd89d781b91cb6e13ba115a54d10c55a954a
TLSH
T14A513B03392AC457286FDDE768F8DF851C44D741A9A27E4E61BC25D96C97600691EC03
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hypt1cqc.nyy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hypt1cqc.nyy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 794e1950125e75391927becce4de3152c7baa36b47474e430915d4fa63713e46
MD5 456fe6dd90ef396796d516655d1cf92d
SHA1 8c6298ef90f5404be90f02fd276159bf9f846176
SHA512 eabed0681b2eb43950749594fe7f0046ec88f8e1ccbd65168492e85567c7a22905bb245fd7142c7ce563c14ddf8cb472a43003d239f4087ab7bf9f5aa1d8776b
TLSH
T13621B13905D6915D1DF340954829F61FE20FC0DB1E2B998D3B5D294F7BA3E1C2722646
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3304-267-0x00000230119D0000-0x00000230119E0000-memory.dmp

Download

memory/3304-269-0x00000230119D0000-0x00000230119E0000-memory.dmp

Download

memory/3304-268-0x000002302AD20000-0x000002302AE39000-memory.dmp

Download

memory/3304-275-0x000002302AD20000-0x000002302AE39000-memory.dmp

Download

memory/3304-24-0x00000230119D0000-0x00000230119E0000-memory.dmp

Download

memory/3304-25-0x00000230119D0000-0x00000230119E0000-memory.dmp

Download

memory/3304-26-0x0000023011950000-0x0000023011972000-memory.dmp

Download

memory/3896-8-0x0000000062800000-0x0000000062813000-memory.dmp

Download